Claims 



1. A method for evaluating contents of a message, comprising: 
characterizing a message segment; 

scanning the message segment to define tokens associated with the message 
segment; 

parsing the tokens to extract substructures; 

determining rules associated with the tokens, the rules when executed defining 
actions; 

executing the actions associated with the message segment; and 
queuing the message segment for transmission to a destination. 

2. The method of claim 1, further including: 

associating the message segment with a meta session through the tokens; and 
retrieving meta session state information related to the message. 

3. The method of claim 1, wherein the message segment is received from a 
sender, the sender using a network to send a message associated with the message 
segment, and the message associated with the message segment is identified as a suspect 
message which is quarantined. 

4. The method of claim 1, wherein the method operation of parsing the 
tokens to extract substructures includes, 

creating a parse tree. 
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5. The method of claim 1, wherein the method operation of determining rules 
associated with the tokens includes, 

defining an object oriented scheme to associate the message segment with at least 
one of the rules. 

6. The method of claim 5, wherein the method operation of defining an 
object oriented scheme to associate the message segment with at least one of the rules is 
enabled through grammar based access. 

7. The method of claim 1, wherein the method operation of parsing the 
tokens to extract substructures includes, 

searching a list of keywords; and 

inferring semantics of sub-strings between the key words. 

8. The method of claim 1, wherein the message is composed of multiple 
segments. 

9. The method of claim 8, wherein the substructures span multiple message 
segments 

10. A computer readable media having program instructions for evaluating the 
contents of a message, comprising 

program instructions for characterizing a message segment; 

program instructions for scanning the message segment to define tokens 
associated with the message segment; 
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program instructions for parsing the tokens to extract substructures; 
program instructions for determining rules associated with the tokens, the rules 
defining actions; 

program instructions for executing the actions associated with the message 
segment; and 

program instructions for queuing the message segments for transmission. 

11. The computer readable media of claim 10, further including: 

program instructions for associating the message segment with a meta session 
through the tokens; and 

program instructions for retrieving meta session state information related to the 
message. 

12. The computer readable media of claim 10, wherein the program 
instruction for characterizing a message segment, 

program instructions for determining a grammar type of the message. 

13. The computer readable media of claim 10, wherein the program 
instructions for parsing the tokens to extract substructures includes, 

program instructions for creating a parse tree. 

14. The computer readable media of claim 10, wherein the message is 
configured to be sent in multiple segments through a packet based network. 
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15. The computer readable media of claim 10, wherein the program 
instructions for parsing the tokens to extract substructures includes, 

program instructions for searching a list of keywords; and 

program instructions for inferring semantics of sub-strings between the key 

words. 

16. A network device configured to provide content based security, 
comprising: 

circuitry for scanning a message to define tokens associated with the message; 
circuitry for extracting substructures from the tokens; 
circuitry for identifying rules associated with the tokens; and 
circuitry for executing the identified rules. 

17. The network device of claim 16, wherein the circuitry for extracting 
substructures from the tokens includes, 

circuitry for associating the message with a meta session. 

18. The network device of claim 16, wherein the circuitry for extracting 
substructures from the tokens includes, 

circuitry for retrieving meta session state information related to the message. 

19. The network device of claim 16, wherein the circuitry for scanning a 
message to define tokens associated with the message includes, 

circuitry for searching a list of keywords; and 

circuitry for inferring semantics of sub-strings between the key words. 
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20. The network device of claim 16, further comprising: 
circuitry for determining a grammar type of the message. 



21. The network device of claim 16, wherein the circuitry for scanning a 
message to define tokens associated with the message includes, 

circuitry for building a data structure from the defined tokens. 
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